Privacy Policy

1. Introduction

Way Too Early Game ("we," "our," or "the Service") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our prediction game service.

2. Information We Collect

Information You Provide

Account Information: Email address, username, and password when you create an account
Predictions: Your baseball season predictions and bracket selections
League Information: League names, descriptions, and membership when you create or join leagues, including join request messages
Two-Factor Authentication: If you enable 2FA, we store a securely stored authentication secret and hashed backup recovery codes
Communication: Any messages or feedback you send to us

Information Collected Automatically

Device Information: Browser type and operating system (from user agent strings recorded in security audit logs)
Log Data: IP address, access times, and referring URLs
Security Data: Login attempt history, account lockout status, and authentication events for fraud prevention
Activity Logs: Records of account-related actions (login, password changes, settings updates) for security auditing
Notification History: In-app notifications sent to your account

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Create and manage your account
Process and display your predictions
Calculate and display leaderboard rankings
Send you service-related communications (account verification, password resets, security alerts)
Send optional notifications about season updates (if you opt in)
Respond to your inquiries and provide support
Protect your account with two-factor authentication when enabled
Monitor and prevent unauthorized access attempts through login tracking and rate limiting
Maintain security audit trails to investigate suspicious activity
Detect and prevent fraud or abuse
Comply with legal obligations

4. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information in the following circumstances:

Public Predictions: If you make your bracket public, your username and predictions may be visible to other users
League Members: Your username and predictions are visible to members of leagues you join
Leaderboards: Your username and score may appear on public leaderboards
Legal Requirements: When required by law or to protect our rights
Service Providers: With trusted third parties who assist in operating our Service (e.g., hosting providers), under confidentiality agreements

5. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information, including:

Encryption of passwords using industry-standard hashing algorithms (bcrypt)
Secure storage of two-factor authentication secrets and hashed backup codes
Secure HTTPS connections for all data transmission
Rate limiting to prevent brute-force attacks
Regular security assessments and updates
Limited access to personal data by authorized personnel only

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Cookies and Tracking

We use cookies and similar technologies for:

Essential Cookies: Required for authentication and session management
Preference Cookies: To remember your settings and preferences

We do not use third-party advertising or tracking cookies. You can control cookies through your browser settings, but disabling essential cookies may prevent you from using the Service.

7. Your Rights and Choices

You have the right to:

Access: Download a copy of all personal information we hold about you using the "Download My Data" feature in your Account Settings
Correction: Update or correct inaccurate information through your Account Settings
Deletion: Permanently delete your account and all associated data using the "Delete My Account" feature in your Account Settings
Opt-Out: Unsubscribe from optional email notifications in your Account Settings
Portability: Download your data in JSON format using the data export feature in your Account Settings

All of these features are available directly in your Account Settings page. No need to contact an administrator.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service:

Account Data: Retained while your account is active
Predictions: May be retained for historical leaderboard purposes
2FA Backup Codes: Retained until you regenerate them or delete your account
Security Audit Logs: May be retained in anonymized form after account deletion for fraud prevention and legal compliance

If you delete your account, we will delete your personal information immediately, except for anonymized audit logs which may be retained for security purposes as permitted by law.

9. Age Requirement

The Service is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected information from someone under 18, we will delete that information promptly. If you believe we have collected information from someone under 18, please contact us.

10. Third-Party Services

The Service may use the following third-party services:

MLB Stats API: To retrieve official baseball statistics and standings (subject to MLB's privacy policy)
Email Service: To send transactional emails
CAPTCHA Service: We may use hCaptcha or reCAPTCHA to prevent automated abuse during registration. These services may collect usage data subject to their respective privacy policies (hCaptcha, Google)

These third parties have their own privacy policies, and we encourage you to review them.

11. International Users

The Service is operated in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service or by email. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please use the data management features in your Account Settings to exercise your privacy rights. For other inquiries, you may contact the Service administrator.